Slow listing projects for user with many role assignments

Bug #1920979 reported by Boris Bobrov
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Identity (keystone)
New
Undecided
Unassigned

Bug Description

With complex structure of inherited roles and groups listing projects and domains a user has access to becomes very slow. Some users are complaining that it takes a minute to get their list of roles.

Some time ago a similar bug has been fixed in https://bugs.launchpad.net/keystone/+bug/1700852, but it seems that there was no real fix and that we just added caching for the call.

It seems that there are several places where too many database calls are made:

1. For example, https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/resource/core.py#L894 could be cached.

2. As mentioned in #1700852, _strip_domain_roles is called many times and is slow

3. add_implied_roles (https://github.com/openstack/keystone/blob/ef711cd0eb5fb6fb143783ad4096e3f1dbd9da99/keystone/assignment/core.py#L629) is slow, probably because `role_api.list_implied_roles` could be cached.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.